ds-report-pdf
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to write a Python script using the
reportlablibrary and execute it via thebashtool to generate PDF files in the local filesystem. - [EXTERNAL_DOWNLOADS]: At runtime, the skill executes
pip installcommands to download and install thereportlabandpillowpackages from the public Python Package Index (PyPI). - [EXTERNAL_DOWNLOADS]: The skill includes functionality to download remote image files (logos) from URLs provided by the user and embed them into the generated PDF reports.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from user-provided files (CSV, JSON) and manual chat input, which is then interpolated into the generated Python code and the final PDF document.
- [COMMAND_EXECUTION]: The skill uses the
catcommand to write user-defined configuration settings into a local file nameddataslayer-config.jsonfor persistence across sessions.
Audit Metadata